Lucene search
WpvulndbWPVDB-ID:C420F079-5803-47EC-9844-28B0785C35F0HistoryDec 28, 2020 - 12:00 a.m.
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
2020-12-2800:00:00
wpscan.com
15
woocommerce
vulnerability
arbitrary order status
EPSS
0.002
Percentile
53.9%
“The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.”
PoC
https://example.com/wp-admin/admin-ajax.php?action=fetch_order_status&order;_id=XX
References
Related
github
github
WooCommerce Incorrect Authorization
2022-05-24 17:37:26
nvd
nvd
CVE-2020-29156
2020-12-27 19:15:11
prion
prion
Deserialization of untrusted data
2020-12-27 19:15:00
wpexploit
wpexploit
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
2020-12-28 00:00:00
patchstack
patchstack
osv
osv
CVE-2020-29156
2020-12-27 19:15:11
WooCommerce Incorrect Authorization
2022-05-24 17:37:26
githubexploit
githubexploit
Exploit for Authorization Bypass Through User-Controlled Key in Woocommerce
2020-12-21 20:38:50
openvas
openvas
WordPress WooCommerce Plugin < 4.7.0 Information Disclosure Vulnerability
2021-01-15 00:00:00
cve
cve
CVE-2020-29156
2020-12-27 19:15:11
cvelist
cvelist
CVE-2020-29156
2020-12-27 18:47:31